CTI · corroborated · 2026-08-14

AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1056 Input Capture Collection
• T1185 Browser Session Hijacking Collection
• T1555 Credentials from Password Stores Credential Access

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• github.aoitour domain · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: AmnesiaStealer ClickFix Fake GitHub Portal Connection
id: 317a60dd-f005-4328-aa27-a77e6443a601
status: experimental
description: >
    Detects connections to aoitour.com, the counterfeit GitHub download
    portal used by the AmnesiaStealer macOS infostealer ClickFix campaign
    (Jamf Threat Labs, August 2026). The fake GitHub-themed page (including
    github.aoitour.com) lures victims into pasting a malicious Terminal
    command, which then prompts for the macOS password and steals credentials
    and Chromium browser session data.
references:
    - https://www.securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/
    - https://cyberpress.org/amnesiastealer-macos-malware-uses-clickfix/
    - https://gbhackers.com/new-amnesiastealer-malware-targets-macos-users/
author: Tia N. List
date: 2026/08/14
tags:
    - attack.t1566
logsource:
    category: network_connection
    product: windows
detection:
    selection_lure_domain:
        DestinationHostname|endswith:
            - 'aoitour.com'
    condition: selection_lure_domain
falsepositives:
    - None known; aoitour.com is not a legitimate GitHub or software-distribution domain
level: high

Splunk SPL raw

# amnesiastealer-macos-malware-steals-data-controls-browser-sessio — Splunk SPL variant (derived from amnesiastealer-macos-malware-steals-data-controls-browser-sessio.sigma via sigma convert)
# source-sha256: cc55c29ea48e3872b76ebb3a439b9ad9535b7786eb4d134ed3ba7786eb812298 v1
DestinationHostname="*aoitour.com"

KQL (Sentinel / Defender) raw

# amnesiastealer-macos-malware-steals-data-controls-browser-sessio — KQL variant (derived from amnesiastealer-macos-malware-steals-data-controls-browser-sessio.sigma via sigma convert)
# source-sha256: cc55c29ea48e3872b76ebb3a439b9ad9535b7786eb4d134ed3ba7786eb812298 v1
DestinationHostname endswith "aoitour.com"

References

• https://www.securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/
• https://cyberpress.org/amnesiastealer-macos-malware-uses-clickfix/
• https://gbhackers.com/new-amnesiastealer-malware-targets-macos-users/